Recommendations

Use the Windows Firewall with Advanced Security snap-in to configure connection security rules to protect IPv6 traffic on your intranet with IPsec. The NAP platform provides additional protection for IPsec-protected communications by requiring that computers meet system health requirements before they can authenticate as an IPsec peer and communicate with protected intranet resources.

Host Protection from Scanning and Attacks

Hosts can be scanned and attacked by malicious software (malware), such as viruses or worms, even when connected to an intranet. During a scan, an attacker attempts to determine the address of a host (an address scan) and the set of Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) ports being listened to by the host (a port scan). An attacker then attempts to access the services and resources of the host or compromise its security.

Address Scanning

With IPv6, the scanning of a subnet for valid unicast IPv6 addresses is made much more difficult by the large number of possible addresses. On an IPv6 subnet, unicast IPv6 addresses use 64 bits for the interface ID portion of the address. Therefore, an attacker must theoretically scan up to 264 possible addresses. In contrast, on an IPv4 subnet, an attacker must typically scan less than 210 possible IPv4 addresses.

A permanent interface ID can be derived in a number of ways. The two most common ways are randomly derived or derived from the Extended Unique Identifier (EUI)-64 address of the network adapter. For local area network (LAN) interfaces, the EUI-64 address can be determined from the 48-bit IEEE 802 address assigned to the network adapter, also known as the media access control (MAC) address. In MAC addresses, the first 24 bits are a company ID that is assigned to the network adapter manufacturer and the last 24 bits are an extension ID that is assigned to an individual network adapter. Because of the way in which EUI-based interface IDs are created from MAC addresses and because the company IDs of widely used network adapters are well known, 40 bits of the 64-bit interface ID can be easily determined. Therefore, it is still possible to perform an address scan on an IPv6 subnet by scanning up to 224 possible combinations of interface IDs. IPv6 for Windows Server 2008 and Windows Vista can use EUI-64–based interface IDs for link-local, unique local, and public addresses, but this is disabled by default permanent.

Randomly derived permanent interface IDs mitigate the risk of address scans by requiring scans of up to 264 possible interface IDs. IPv6 for Windows Server 2008 and Windows Vista by default uses randomly derived permanent interface IDs for link-local, unique local, and public addresses.